[How To] Root 2.3.4/downgrade and Get S-off

ATTENTION:
first and formost i want to say i am happy to have created a thread that has gone to 29+ pages,1400+posts,and helped so many folks. however,it seems that recent updates to the original incredible have unfortunately broken the zerg rush exploit,and made the older version of unrevoked found to work on older gingerbread builds finicky at best.

lately it seems this thread is possibly causing more fustration and confusion than it is helping,so after much thot i have decided to declare this thread *OUTDATED*

while not perfect,htc's own unlock is a reliable means to get root for the downgrade,and has thus proven to be predictable,reliable way to downgrade and get s-off.

thanks to everyone who have participated in the discussions here,with a particular shout out to sdraw and iowa!

_________________________________________________________________PLEASE NOTE: this thread is for the original droid incredible. NOT the incredible 2(vivow) or incredible S(vivo)
for info on downgrading the inc 2 to .97 hboot so you can root with revolutionary,see this thread here in the inc 2 all things root subforum

if you DO have an original droid incredible,aka Inc 1,then procede
_________________________________________________________________

**********************************************************

_________________________________________________________________READ THIS: i dont mean to sound like i dont want to be bothered with questions. however,folks are having basically the same issues thru-out the 600+ posts,so i can almost gauarntee if you have a prollem,it has been covered. please try and search for some answers before jumping to the end and posting. answering the same things over and over is just making the thread even longer and harder to search.

if you do have trouble and need to post questions about ADB commands,please provide a copy of your entire session in the command window along with the question. its usually pretty easy to see what went wrong when we can see the whole thing.

copy everything in the command window,and paste it into a code box by:
-right click in the command window,click mark.
-highlight everything in white. hit enter.
-then,in your "reply to thread" box here,click the "#" up top
-right click and "paste" everything between the

Code (Text):

tags.

_________________________________________________________________

i cant take credit for any of this,i just took it all from different places and put it all here. unfortunately,i cant gaurantee that this will work for everyone. but several now have rooted 2.3.4,and 1 has succesfully downgraded and gained s-off.

its intended for someone who has no adb experinece,and is overwhelmed at the thot of downloading and installing the SDK. if your proficient at adb,your welcome to pull flash_image and mtd0 out,and place them in tools,platform tools,or wherever you usually push files from,rather than changing to the mini-adb_inc directory.

thots and feed back are welcome. there will prolly be several edits of this as i try to clarify it,and make it a lil better. but for now im tired and 5am comes early ;)

[B]first and foremost,giving proper credit to all that deserve it:[/B]

*alpharev and unrevoked for all they for the root community :cool:

-efizzle for getting the ball rolling in [URL="http://forum.xda-developers.com/showthread.php?t=1286223"]this thread[/URL] on xda by figuring out that an older version of unrevoked would get superuser access on 2.3.4

-iowabowtech for point me in the direction of [URL="http://forum.xda-developers.com/showthread.php?t=768295&highlight=ota"]this thread[/URL] that i collected the misc image,and parts of the guide. also for his support answering questions.

-sele and the crew in the "rescue squad" on [URL="http://api.viglink.com/api/click?format=go&drKey=1153&loc=http%3A%2F%2Fandroidforums.com%2Fthunderbolt-all-things-root%2F418539-thunderbolt-root-unroot-thread.html&v=1&libid=1318297929451&out=http%3A%2F%2Fwww.thunderboltforums.com%2F&ref=http%3A%2F%2Fandroidforums.com%2Fthunderbolt-all-things-root%2F&title=Thunderbolt%20Root%2FUnroot%20Thread%20-%20Android%20Forums&txt=HTC%20Thunderbolt%20Forum&jsonp=vglnk_jsonp_13182980284911"]the thunderbolt forum[/URL] for what i like to call the "mini-adb" concept.

-rooter28 for testing and keeping me updated as he made progress. hopefully he will stop in and help answer questions :)

-mkreiger for fearlessly jumping in to be the second official tester

-lovejess for finding a mac download for unrevoked 3.22

-gkinsella2 for contributing the mac specific instructions

-whomever origianlly came up with the images and guide linked above. if i can figure out who this was,ill add you in later.

*special thanks to sdrawcab for his invaluable support in helping answer questions and prollems

-prolly more,im sure there will be several edits of this.

1)[B][I]download these files[/I][/B],and save them somewhere you can easily find them:

if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: [url=http://www.md5summer.org/]Home of the MD5summer[/url]

2)[B][I]root with unrevoked 3.22[/I][/B]

-go to settings/applications and [U]uncheck[/U] "fastboot". having this checked will prevent you from getting to hboot via power/vol down.

-open the recovery-clockwork-5.0.2.0-inc_PB31IMG download. extract it first if you need to. inside there is an image called "recovery-clockwork-5.0.2.0-inc". right click on this image,then click "copy". navigate to a directory you can easily find it,then right click in that directory,then "paste". alternatively,you can drag it from the extracted folder to a convienient spot(i personally like to drag files around,but its fine either way).

-use your md5 summer to verify the md5 of just the image,not the whole .zip. it should be: [COLOR="Red"]ea382ca5809cb872d0582aa22741d592[/COLOR]

-install the drivers as described on unrevokeds page above.

-unplug your phone.

-extract the contents of the unrevoked 3.22 .zip. open the folder, right click on "reflash" and run as administrator if possible.

-click on "file" in the corner of the relfash window

-click custom recovery

-navigate to,and select your "recovery-clockwork-5.0.2.0-inc" image and select it. at the bottom of your reflash app window, it should now say "recovery:custom" and "waiting for device"

-make sure usb debugging is checked ON in settings/applications/development.

-plug in your phone and place it in charge only mode. assuming you installed the drivers correctly,unrevoked 3.22 will start. let it do its thing. it will reboot a couple of times. when its finished,it may leave you on a blank screen. if this is the case,pull the battery and reboot.

-you [I]should[/I] now have the superuser app in your app drawer. if so,go to settings/applications/manage apps/superuser and clear data. test that superuser is working and granting permissions by downloading rom manager,and using it to flash the newest clockwork recovery. alternatively,download and run a "root checker" or any of your favorite "root only" apps and make sure they work.

-once you get "successfully flashed clockwork recovery" boot to it and make a backup,since downgrading to get s-off [U]WILL[/U] wipe all your data. boot back into the operating system.

*[I]special note to slcd users[/I]: this version of unrevoked is installig an old, non-compatible version of clockwork,so you will just see a black screen if you do not install newer clockwork as described above.

-if you plan to install a custom rom after downgrading,now is a good time to download titaium backup,and its pro key(WELL worth the $$) and do a batch backup of all your user apps and app data(no system data)

*at this point,you could just enjoy root access without doing anything else. if all you care about is using a couple of root only apps,and deleting some bloatware,you can remain rooted and s-on if youd like. id personally reccomend to downgrade and become s-off in case future OTAs knock out your root access.

3)[B][I]prepare to downgrad[/I]e[/B]

-extract the mini-adb_inc .zip. place the extracted folder on the root of your c drive. it comtains mtd0,flash_image,and some adb tools.

-place the 2.2 downgrade on the root of your sd card,and verify it is named "PB31IMG". now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting [U]WILL[/U] wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.

[U]special notes on hboot flashing PB31IMG files[/U] a common issue folks are having is the PB31IMG is not being found by hboot.

*there are only 2 reasons a PB31IMG is not found on the root of the sd card:

a)not named correctly. the phone muse see exactly "PB31IMG.zip". due to the way windows automatically adds and hides file extensions,it is usually correct to name the file "PB31IMG" with windows. common errors are for the file to be named "PB31IMG.zip.zip" after manually tying in the ".zip". on rarer occasions,it may not be adding/hiding the file extension,resulting in the file actually beening seen by the phone as "PB31IMG" :eek: [I]check your file with a file manager on your phone[/I] and see how its seeing it.

b)sd card not formatted FAT32. if it is plain FAT or anything else,PB31IMG is invisible. on rare occasion,i have seen claims that a bad sd card,or card that needs reformatted(even tho it may be FAT32) will have the same affect.

*this has been addressed [U]several[/U] times in the thread,skim thru it for more information.

4)[B][I]downgrade with adb[/I][/B]. make sure your phone is charged to 100% before starting.

-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in [B]bold[/B] so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.

at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.

[B]md5sums mtd0.img [/B] [COLOR="blue"]it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839

[/COLOR]

[B]md5sums flash_image[/B] [COLOR="blue"]again,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a[/COLOR]

[COLOR="Red"]*both those numbers must match exactly. if they do then you can procede.

[/COLOR]

[B]adb push flash_image /data/local/[/B]

[B]adb push mtd0.img /sdcard/[/B]

[B]adb shell[/B] [COLOR="Blue"]your prompt should change to a #. if it changes to a $,then type[/COLOR] [B]su[/B] [COLOR="blue"]note your phone may pop up a message asking you to allow permissions the first time you do this. if it does check "always" and touch "allow" on the superuser request on the phone screen.[/COLOR]

[B]cd /data/local[/B]

[B]chmod 0755 /data/local/flash_image[/B]

[B]cd /data/local[/B]

[B]./flash_image misc /sdcard/mtd0.img[/B]

[COLOR="blue"]you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off[/COLOR]

[B]exit[/B] [COLOR="Blue"]to get out of your adb shell,and back to the "mini-adb_inc" prompt[/COLOR]

[B]adb reboot bootloader[/B] [COLOR="blue"]this will boot your phone to "fastboot" select "bootloader" with the power button.[/COLOR]

hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.

let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.

*[I][U]special note:[/U][/I] if your phone does not fully boot after running PB31IMG,dont panic. its happened to quite a few users,for some reason. simply pull your battery,boot to hboot via power/volume down and run PB31IMG again.

run it as you did the previous version. before plugging in your phone,make sure "disable phone security is checked" in the file menu. this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.

[I][U]*unrevoked 3.32 note:[/U][/I] if you check the "disable phone security" box as described above,and unrevoked still fails to turn s-off,you are not lost.[U]simply flash the s-off tool in recovery[/U]. you can find it here: [url=http://unrevoked.com/rootwiki/doku.php/public/forever]public:forever [RootWiki][/url]

if you wish to return to where you were,sign into google,download rom manger,flash the latest clockwork recovery. boot to recovery,then restore the back you made before we started.

optionally,you can now install the custom rom of your choice,along with a new recovery and radio if you desire. :)

and heres what you will see when entering the commands(the red are my copy/paste's):

this is for folks who for whatever reason,unrevoked 3.22 does not work to get them root access.

this could also be used if youve got a replacement device thats not setup,and you could care less about installing a recovery. this still requires unrevokeds drivers to be set up,so you can root with unrevoked 3.32 after downgrading,but otherwise,it prolly is a lil quicker since you dont need to download and run unrevoked 3.22.

alternately,use this if you just like ADB if your proficient in adb,feel free to remove the images from mini-adb_inc,and place them and the zergRush tool into whatever folder you typically push files from.

like above,this is intended for someone whose never installed ADB or entered command lines before.

1)download these files,and save them somewhere you can easily find them:

**make sure to check the md5 sums match those listed!**
if you dont have an md5 sum verifier on your PC,there are many out there for free. heres an example: Home of the MD5summer

3)prepare to downgrade
-extract the mini-adb_inc .zip. place the extracted folder on the root of your c\ drive. it comtains mtd0,flash_image,and some adb tools.
-extract zergRush.zip. take the image inside,and either copy/paste or drag it into your mini-adb_inc folder
-place the PB31IMG of 2.2 on the root of your sd card. rename PB31IMG. now is a good time to verify that your SD card is formatted "FAT32" by right clicking on the drive that is your phones sd card,then click "properties". if you find your card is formated anything else,youll have to re-format it. start by backing up all files to your PC as reformatting WILL wipe it clean. using your PC,do a full format to FAT32. you can then transfer the files back. *this is important-as your phone will not find the downgrade PB31IMG unless your card is formatted to FAT 32,and the file is correctly named.

4)downgrade with adb. make sure your phone is charged to 100% before starting.
-on windows 7,click the start bubble and type "command" in the search box. this should open a small black command window. from this point forward,all code will be in bold so you know what lines to copy and paste(or type,if you really want to type them all in). additional comments will be blue,and should not be copy/pasted. please note that each line is one command. copy/paste it into the prompt in your command window,and push enter. one line at a time.

at the end of the post,is a copy of my session,to show what the outputs of the entered lines should look like. hopefully,its a little less scary when you know that youre getting the right responses to the things you enter.

-make sure phone is plugged in and usb debugging checked on in charge only mode

-at the promt in your command window:

cd c:\mini-adb_inc this should change your command promt to "mini-adb_inc",indicating youre using that directory.adb devicesthis should output your phones serial number,indicating its recognized

md5sums mtd0.img it should output a few things.at the end you should see this number 34307be744275f1db1dd16af04c37839

md5sums flash_imageagain,it will output some things,then you should see this number: 0098a7dd6600b55fac34fc6645be5d7a

md5sums zergRushagain,output stuff, then this number:4a32187446c284c2b975845f3ab9ffc4

*all those numbers must match exactly. if they do then you can procede.

this will cause zergRush to start,and it shoudl say "found a gingerbread!" followed by a bunch of other funny stuff.

last thing it says will be: Killing ADB and restarting as root... enjoy!

you should then be returned to your "mini-adb_inc>" prompt

adb push flash_image /data/local/adb push mtd0.img /sdcard/

adb shellyour prompt should change to a #

cd /data/localchmod 0755 /data/local/flash_image

cd /data/local./flash_image misc /sdcard/mtd0.img

you can now downgrade back to 2.2,so you can run "unrevoked forever" to regain s-off

exitto get out of your adb shell,and back to the "mini-adb_inc" prompt

adb reboot bootloaderthis will boot your phone to "fastboot" select "bootloader" with the power button.

hopefully what you will see now,is a blue status bar as your phone finds the PB31IMG,unpacks it,checks it,then asks if youd like to update. select yes to update with the volume up rocker. if youve never installed a full ruu in hboot,it will take a few minutes,so dont panic. place the phone gently down somewhere where it wont fall and spit out the battery. let it do its thing. push power to reboot when prompted.

let the phone fully boot,then place in disk drive mode and immediately delete PB31IMG from your sd card,as it will interefere with running unrevoked forever.

run unrevoked(extract the contents,right click on "reflash",run as adminstrator if possible). this time,it will root you,and turn the secure flag off on your radio. this is good,as it will allow you to always flash things that werent signed and approved by htc. you can flash new radios and recoveries,and flash any ruu you wish. the secure flag is in the radio,so running ruus or even accepting OTAs will not over-ride it. you will always stay s-off.

and heres what you should see when entering the commands(my copy/pastes are in red):

edit:apparently the zergRush tool has changed. ive included the new md5s,so hopefully there wont be any more confusion like the old md5s caused earlier. be aware of this,however, in case they do change again. you are right to be cautious if it doesnt match,so ill do my best to keep up with it.

2nd edit:
if you get the following error trying to run zergRush: " [-] Cannot copy boomsh : No such file or directory",dont panic.

that error comes from running zergrush twice. reboot your phone,push and run zergrush again,then when you get the error,enter the following:rm /data/local/tmp/boomsrm /data/local/tmp/sh
then/data/local/zergRush

it should look something like this(just pretend that miniadb_merge says mini-adb_inc ):

awsome! im glad it worked for you as well. i dont understand why this particular version worked to get root access,but i believe there is some old saying about looking gift horses in the mount

i wish i knew what to tell you about the recovery. my feeling is that the CW it installs is not compatible with the slcd,and for some reason rom manager is not updating it.

future testers can try flashing the alternate recovery after flashing clockwork with rom manager,or... (i cant believe im about to say this) you can try making a backup with rom manager. its ok this one time,but then dont do it again (im not fan of rom manager). tho in theory,this should work,as if CW wasnt there,when you booted to it youd see a triangle and ! indcating the stock recovery.

at least it gets you root access. if the main goal is to downgrade so you can get s-off,it doesnt matter if the recovery is working or not.

also forgot to add,that you could install busybox and titanium backup prior to downgrading,and at least back all your apps and app data up that way

the guy that figured this out had a functional CW on his phone,i havent beeen able to confirm that he has an amoled,but im pretty sure thats what the difference is.

My phone has never been rooted. My goal is to root, so that I can install a couple of important apps, and perhaps get rid of some bloatware. Will this work for me if I stop after I get the SuperUser app? Whats the easiest way to prevent getting an OTA update?

You could add a compatible recovery (for slcd and AMOLED) before running unrevoked on gingerbread. There is a recovery.img file included in the unrevoked package that can be replaced.

Click to expand...

How do you find this? I'm scanning the contents of the 3.22 reflash package and I'm not coming up with a recovery.img that I can get my hands on.

Edit: I think I remember now...I didn't have my phone plugged in. I bet that's required to force the self-extract? Seem to remember that now from earlier attempts. I was trying to dig my way into the temp files while false executing the .exe, no worky.